linux-hardening - Re: [PATCH v4 2/4] mm/usercopy: Detect vmalloc overruns

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 17 Dec 2021 13:07:07 +0000
From:   Mark Hemment <markhemm@...glemail.com>
To:     "Matthew Wilcox (Oracle)" <willy@...radead.org>
Cc:     Kees Cook <keescook@...omium.org>, linux-mm@...ck.org,
        linux-hardening@...r.kernel.org,
        William Kucharski <william.kucharski@...cle.com>
Subject: Re: [PATCH v4 2/4] mm/usercopy: Detect vmalloc overruns

On Thu, 16 Dec 2021 at 21:55, Matthew Wilcox (Oracle)
<willy@...radead.org> wrote:
>
> If you have a vmalloc() allocation, or an address from calling vmap(),
> you cannot overrun the vm_area which describes it, regardless of the
> size of the underlying allocation.  This probably doesn't do much for
> security because vmalloc comes with guard pages these days, but it
> prevents usercopy aborts when copying to a vmap() of smaller pages.
...
> +               offset = ptr - vm->addr;
> +               if (offset + n > vm->size)
> +                       usercopy_abort("vmalloc", NULL, to_user, offset, n);
> +               return;
> +       }

Instead of vm->size, call get_vm_area_size() so any guard page is
trimmed from the length.

Mark